Somebody in your office probably has administrator access to their computer right now, and nobody remembers why. It usually goes back to one afternoon. They needed a printer driver, or a program wanted an update, and the quickest fix was to make them an administrator on that machine. The printer worked. The access never got taken back.

That is how most small businesses end up with half the staff running as administrators. Nobody decided it. It just piled up, one request at a time.

I want to walk through what that access actually lets someone do, why it matters on the day something goes wrong, and how to take it back without anyone losing a morning of work.

How administrator access ends up on everyone’s computer

Here is the usual order of events. A new hire starts. Their laptop gets set up in a hurry, and whoever set it up signs them in with an administrator account because it avoids the pop-ups. Or the laptop came from the store with one account on it, and that one account is an administrator by default.

A year later the business has six computers and six people with administrator access. Nobody is doing anything wrong. They are just doing their jobs on accounts that can change anything on the machine.

The access sticks because removing it feels like a risk. If you take it away, will something break? Will they call you every time they need an update? Those are fair questions, and I will answer both further down. The short version is that the access was never needed for normal work in the first place.

What an administrator can actually do

On a Windows computer, an administrator has full control of that machine. Microsoft’s own guidance on local accounts recommends keeping the number of administrators on each computer as small as possible. Macs work the same way, and Apple’s advice is to use a standard account whenever you do not need administrator rights.

Depending on how the computer is set up, someone with administrator access can:

• Install and remove any program
• Add drivers for printers, scanners, and other equipment
• Create, change, or delete other user accounts on that computer
• Change system settings, including some security settings
• Change who can open which files and folders
• Install programs that keep running quietly in the background

One thing that trips people up: this is about the computer itself. It is a different thing from being an administrator in Microsoft 365 or Google Workspace. Someone can have administrator access to their own laptop without having any control over your company email. Both kinds of access matter, and both need checking, but they are checked in different places.

Why administrator access matters on the bad day

You have seen the pop-up. You try to install something, the screen dims, and Windows asks whether you want to allow this app to make changes to your device. That box is called User Account Control. It is the moment Windows asks for permission before something changes the computer.

If you are signed in with administrator access, that box has a Yes button, and you can click it yourself. If you are signed in with a standard account, the box asks for an administrator’s password instead. Microsoft explains the details in how User Account Control works, but the practical difference is that one click.

Now picture the bad day. Someone searches for a free PDF tool, lands on a fake download page, and runs the installer. With administrator access, they click Yes, because they always click Yes. The program now has permission to install itself deep in the computer, change settings, and stay there.

On a standard account, the same installer stops and asks for a password the employee does not have. That pause is the whole point. It gives someone the chance to ask what the program is and where it came from before it gets in.

This is not a fringe idea. The federal government’s StopRansomware guide from CISA tells businesses to control who has local administrator access and who can install software. The Australian Cyber Security Centre puts restricting administrative privileges on its short list of the most important security measures.

What a standard account can still do

This is where people expect the bad news, and there is not much of it. A standard account handles almost everything an office worker does in a day:

• Email, web browsing, and online meetings
• Microsoft 365 or Google Workspace
• Your accounting software, scheduling system, and other approved business programs
• Printing to a printer that is already installed
• Opening, saving, and sharing files
• Personal settings like the desktop background and the default browser

Some programs even install for one person without administrator approval. The ones that need it are the ones that add drivers, background services, or files in protected parts of the computer, which are exactly the changes you want a second set of eyes on.

The real snag is older business software. Every so often a line-of-business program was written years ago and expects the person using it to have administrator access. In our experience it usually does not need full administrator access at all. It needs permission to write to one particular folder, and that can be granted on its own. That is a ten-minute fix once someone looks at it, and it is the reason you test before you change anything.

Who actually needs administrator access

The honest list is short:

• Your IT provider, through a managed account they control
• Internal IT staff, if you have them
• Someone whose job is testing or installing software, and only through a separate account

That list does not include the owner. I know that one can sting a little. Owning the business does not mean your everyday account needs administrator access to your laptop. Use a standard account for email and normal work, the same as everyone else. If you need to make a change, use a separate administrator account for that task and then go back to your normal one.

The reason is not about trust. The owner’s account is usually the most valuable one in the building, so it is the one attackers want most. Keeping its everyday power low is how you protect it.

Taking administrator access back without stopping work

The mistake to avoid is ripping it out of every computer on a Friday afternoon. Do it in order and nobody notices much.

Find out who has it

Look at the administrator list on every Windows computer and every Mac. You are looking for current employees, but also old accounts, shared logins, accounts a vendor created during setup, and the account the laptop shipped with. Most businesses find more than they expected.

Ask what each one is for

For every person on that list, ask what they actually use administrator access for. A real, regular need is a reason to look at a separate account. Updating one program twice a year is not.

Make sure IT can still get in

Before anyone loses access, confirm your IT provider can sign in to each computer with its own protected administrator account. Test it on every machine. This is the step that keeps you from locking yourself out of your own computers.

Test the programs people depend on

Sign in as a standard user and open the programs each person needs. Check that they start, save, print, and update. Anything that complains gets looked at before the change becomes permanent.

Switch the accounts and set up a way to ask

Change each person’s account to a standard account and have them sign out and back in. Then tell everyone who to contact when they need something installed: the program name, why they need it, and where it comes from. For our clients, that request comes to us and we install it remotely. Nobody has to hand out a password.

After that, check administrator access whenever someone changes jobs or leaves. We cover that part in our post on clean onboarding and offboarding.

The problem nobody asks about: one password for every computer

Here is the thing I find most often, and it is worse than staff having administrator access. Every computer in the office has the same local administrator password. It was set once, years ago, and it has never changed.

That means if the password is stolen from one laptop, it works on all of them. So one infected computer can open the door to every other computer in the office. Each machine should have its own administrator password, or better, a management service should set and rotate those passwords so nobody has to remember them. If you take one thing from this post besides the standard accounts, take this one.

What removing administrator access does not fix

I want to be straight about the limits. Taking away administrator access cuts down what a harmful program can change. It does not stop every attack. A phishing email can still steal a password from someone on a standard account, and some attacks do not need administrator rights at all.

So it is one layer of protection, and the others still matter. You still need updates installed, endpoint protection on every computer, multi-factor sign in, and backups you have actually tested. If you want to see what cleaning up admin rights does to your support load, our earlier post on revoking admin rights covers that side of it.

Frequently asked questions

Should employees have admin rights on their work computers? For everyday work, no. Email, browsing, and business programs all run on a standard account. Keep administrator access for your IT provider and for specific tasks that require it.

Can a standard user install software? Sometimes. Programs that install only for that one person may work. Anything that adds drivers, background services, or system files will ask for an administrator’s password.

Will taking away administrator access slow my team down? Not for normal work. The one place it can bite is older business software, which is why you test each program on a standard account before you switch everyone over.

Is administrator access on a laptop the same as being a Microsoft 365 admin? No. Local administrator access controls one computer. A Microsoft 365 administrator can control email, files, and user accounts for the whole company. Review both, separately.

What if the owner needs to install something? Use a separate administrator account for that task, or ask your IT provider to install it. Keep your everyday account standard, because it is the one attackers most want.

If you are not sure who in your office has administrator access, that is usually the first thing we find when we look. Our cheat sheet on the 7 cyber mistakes small businesses make walks through this one and six others, and it takes about ten minutes to read.

Featured image: Pexels